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DETAILED ACTION 

This action is in response to an amendment filed on January 04, 2007 for the 
application of Gibart et aL, for a- "High speed synchronization in dual-processor safety 
controller" filed September 16, 2003. 

Claims 1-8, 10-11, 13-14, and 17-28 are pending in the application. 
Claims 1-8, 10-11, 13-14, and 17-28 are rejected under 35 USC § 103. 
Claim 1 has been amended. 
Claim 16 has been cancelled. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 
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Claims 1-8, 13-14, and 17-28 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Danielsen et al. (U.S. Patent No. 5,136,704) in view of Fruehling et 
al. (U.S. Patent No. 6,981,176). 

As per claim 1 , Danielsen discloses a safety controller comprising: 
a first and second processing unit (Fig. 3, Processor A and Processor B) 
communicating on a communication bus (Fig. 3, element 12, 14), each including a 
processor (Fig. 4, Processor A and Processor B) and memory (Fig. 4, elements 42, 44), 
the memory of each of the first and second processing units loadable with a common 
safety program and input/output variables, wherein the safety program is repeatably 
executable to read input variables representing inputs from external controlled devices 
and write output variables representing outputs to external controlled devices (col. 3, 
lines 1-8) 

a synchronization program (col. 5, lines 51-61) executable by the first and 
second processing units to execute.the common safety programs based on identical 
copies (col. 3, lines 1-8) and to compare execution of the common safety programs and 
to enter a safety state when this execution differs (col. 3, lines 57-68 through col. 4, 
lines 1-5). 

Danielsen fails to explicitly disclose a buffer. 
Fruehling et al. teaches: 
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at least one processor (Fig. 2, element 12) including a buffer receiving a plurality 
of input variables (Fig. 2, element 28) asynchronously from I/O circuits connected to 
sensors (col. 11, lines 16-24) 

a coordinator program providing each of the first and second processing units 
with identical input variables from the buffer at a predetermined point in the repeated 
execution of the common safety programs (col. 11, lines 16-24) 

Figures 2 and 3 of Fruehling et al. show the data bus 30 transmits data. This data 
can be either instruction opcode/operand data or external data as might be collected 
from a peripheral sensor and converted by and A/D converter, or digitized Wheel-speed 
information. The control signals generated by the secondary CPU 14 go directly to 
functional compare module 18. The secondary CPU 14 gets all the same inputs as the 
main CPU 12, but the output of secondary CPU 14 only gets routed to functional 
compare module 18 (col. 11, lines 16-24). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention to use the Secured microcontroller architecture of Fruehling et al. in the 
redundant microprocessor control system of Danielsen et al. to detect faults in the dual 
processing systems. 

One of ordinary skill in the art at the time the invention would have been 
motivated to make the combination because Danielsen et al. disclose a redundant 
microprocessor system and method that features a high level of safety with improved 
reliability by comparison of outputs generated by two processors in synchronization (col. 
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3, lines 1 1-21). Danielsen et al. system uses a bus for communication between the two 
processing elements (Fig. 3, element 12). Fruehling et al. discloses a multi processor 
system with input/output signals and processor mismatch detection (col. 8, lines 49-56). 
Both inventions include receiving identical input variables that are passed to both 
processors (Danielsen, col. 3, lines 9-21) and (Fruehling, col. 11, lines 22-24). Using a 
common memory to store the input signals and providing identical copies to both 
processors and comparing the outputs to ensure synchronization provides a high level 
of safety with improved reliability (col. 2, lines 1-5 and col. 3, lines 11-21). 

As per claim 2, Danielsen discloses in the coordination program provides 
identical input variables at only a single point in the repeated execution of the common 
safety programs (col. 5, lines 51-61). 

As per claim 3, Danielsen discloses at least one of the processing units further 
executes a non-safety program and wherein the predetermined point in the repeated 
execution of the common safety programs is the start of the common safety programs 
(col. 5, lines 51-61). 

As per claim 4, Danielsen discloses the synchronization program compares 
execution of the safety program by comparing output variables generated by the first 
and second processing unit executing the safety program (col. 3, lines 57-68 through 
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As per claim 5, Danielsen discloses the safety program is executed repeatedly 
and wherein the comparison of the output variables is performed at the conclusion of 
each repeated execution immediately prior to outputting of the output variables to the 
external controlled device (col. 3, lines 53-64). 

As per claim 6, Danielsen discloses the safety program also executes to 
generate values of internal variables different from the input and output variables and 
wherein the synchronization program compares execution of the safety program by 
comparing values of internal variables generated by the first and second processing unit 
executing the safety program (col. 4, lines 23-41). 

As per claim 7, Danielsen discloses the safety program is executed repeatedly 
and wherein the comparison is performed at a period greater than the repetition period 
(col. 3, lines 57-68 through col. 4, lines 1-5). 

As per claim 8, Danielsen discloses the coordination program stops the common 
safety programs execution at the predetermined point in the repeated execution of the 
common safety program until the identical input variables have been provided to the 
common safety programs (col. 4, lines 6-20). 
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As per claim 13, Danielsen discloses the synchronization program combines the 
output variables when the execution of the common safety program does not differ to 
produce a single set of output variables transmittable to the controlled device. Figure 1 1 
shows input port 136 and output port 135 are combined in the switch 138 and result in 
an output from the switch. 

As per claim 14, Danielsen discloses the combination creates a message having 
one output variable concatenated to the value of the output variable complemented (col. 
6, lines 7-17). 

As per claim 17, Danielsen discloses a method of operating a safety controller 
having a first and second processing unit (Fig. 3, Processor A and Processor B) each 
including a processor (Fig. 4, Processor A and Processor B) and memory (Fig. 4, 
elements 42, 44), the memory of each of the first and second processing units loadable 
with a common safety program and input/output variables, wherein the safety program 
is repeatably executable to read input variables representing inputs from external 
controlled devices and write output variables representing outputs to external controlled 
devices (col. 3, lines 1-8), the method comprising the steps of: 

(b) executing by the first and second processing units the common safety 
programs and comparing execution of the common safety programs to enter a safety 
state when this execution differs (col. 3, lines 57-68 through col. 4, lines 1-5). 

Danielsen fails to explicitly disclose a buffer. 
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Fruehling et al. teaches: 

(a) accumulating asynchronous input variables in a buffer (col. 11, lines 16-24) 
(a) providing each of the first and second processing units with identical copies of 
the accumulated input variables from a buffer at a first time at a predetermined point in 
the repeated execution of the common safety programs (col. 11, lines 16-24) 

Figures 2 and 3 of Fruehling et al. show the data bus 30 transmits data from the 
common memory (Fig. 2, element 16). This data can be either instruction 
opcode/operand data or external data as might be collected from a peripheral sensor 
and converted by and A/D converter, or digitized Wheel-speed information. The control 
signals generated by the secondary CPU 14 go directly to functional compare module 
18. The secondary CPU 14 gets all the same inputs as the main CPU 12, but the output 
of secondary CPU 14 only gets routed to functional compare module 18 (col. 1 1 , lines 
16-24). 

As per claim 18, Danlelsen discloses step (a) provides identical input variables at 
only a single point in the repeated execution of the common safety programs (col. 5, 
lines 51-61). 

As per claim 19, Danielsen discloses the predetermined point in the repeated 
execution of the common safety programs is the start of the common safety programs 
(col. 5, lines 51-61). 
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As per claim 20, Danielsen discloses step (b) compares execution of the safety 
program by comparing output variables generated by the first and second processing 
unit executing the safety program (col. 3, lines 57-68 through col. 4, lines 1-5). 

As per claim 21, Danielsen discloses the safety program is executed repeatedly 
and wherein step (b) is performed at the conclusion of each repeated execution 
immediately prior to outputting of the output variables to the external controlled device 
(col. 3, lines 53-64). 

As per claim 22, Danielsen discloses the safety program also executes to 
generate values of internal variables different from the input and output variables and 
wherein step (b) compares execution of the safety program by comparing values of 
internal variables generated by the first and second processing unit executing the safety 
program (col. 4, lines 23-41). 

As per claim 23, Danielsen discloses the safety program is executed repeatedly 
and wherein the comparison is performed at a period greater than the repetition period 
(col. 3, lines 57-68 through col. 4, lines 1-5). 

As per claim 24, Danielsen discloses step (a) stops the common safety 
program's execution at the predetermined point in the repeated execution of the 
common safety program until the identical input variables have been provided to the . 
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Page 10 



As per claim 25, Danielsen discloses identical input variables are provided by 
copying of input variables from the first processing unit to the second processing unit 
(col. 6, lines 7-17). 

As per claim 26, Danielsen discloses the first processing unit includes a buffer 
memory (Fig.11, element 121) receiving input variables asynchronously and wherein 
step (a) copies the buffer memory identically to memory in each of the processing units 
(col. 6, lines 7-17). 

As per claim 27, Danielsen discloses step (b) combines the output variables 
when the execution of the common safety program does not differ to produce a single 
set of output variables transmittable to the controlled device. Figure 1 1 shows input port 
136 and output port 135 are combined in the switch 138 and result in an output from the 
switch. 

As per claim 28, Danielsen discloses the combination creates a message having 
one output variable concatenated to the value of the output variable complemented (col. 
6, lines 7-17). 
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Claims 10 and 11 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Danielsen et al. (U.S. Patent No. 5,136,704) in view of Fruehling et al. (U.S. Patent 
No. 6,981,176) and further view of Griffin et al. (U.S. Patent No. 6,928,583). 

As per claim 10, Danielsen in view of Fruehling fails to explicitly disclose a 
backplane. 

Griffin teaches: 

the communication bus is a backplane having releasable electrical connectors 
allowing connection of the first and second processing unit to and from the backplane 
(col. 13, lines 20-39). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention to use the method of fault tolerance of Griffin et al. in the redundant 
microprocessor control system of Danielsen et al. to detect faults in the dual processing 
systems. 

One of ordinary skill in the art at the time the invention would have been 
motivated to make the combination because Danielsen et al. disclose a redundant 
microprocessor system and method that features a high level of safety with improved 
reliability by comparison of outputs generated by two processors in synchronization (col. 
3, lines 11-21). Danielsen et al. system uses a bus for communication between the two 
processing elements (Fig. 3, element 12). 

Griffin et al. discloses a method for a first computing element and a second 
computing element to execute in lockstep in a fault-tolerant server. Fault detection is 
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performed by output comparison (col. 2, lines 12-26). Griffin et al. uses a 
communication bus for communication between the two processing elements (Fig. 1 , 
element 30). 

As per claim 1 1 , Danielsen in view of Fruehling fails to explicitly disclose a serial 

bus. 

Griffin teaches: 

the communications bus is a serial communications network having releasable 
electrical connectors allowing connection of the first and second processing unit to and 
from the serial communication bus (col. 3, lines 45-53). 

Response to Arguments 

Applicant's arguments see pages 7-8, filed January 04, 2007 have been fully 
considered and are persuasive. Therefore, the rejection has been withdrawn. However, 
upon further consideration, a new ground(s) of rejection is made over Danielsen et al. 
(U.S. Patent No. 5,136,704) in view of Fruehling et al. (U.S. Patent No. 6,981,176) and 
further view of Griffin et al. (U.S. Patent No. 6,928,583). Refer to the corresponding 
section of the claim analysis for details. 
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Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Elmira Mehrmanesh whose telephone number is (571) 

272- 5531. The examiner can normally be reached on 8-4:30 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Robert W. Beausoliel can be reached on (571) 272-3645. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 

273- 8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
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For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



